From: Hawkins, E. A. (WF) (FBI) <Adrian. Hawkins@ic.fbi.gov> 


Sent: Wednesday, October 12, 2016 12:05 PM 
To: Rich, Patricia R. (SF) (FBI) <Patricia. Rich@ic.fbi.gov> 
Subject: RE: Follow Up 


Sure! If you end up needing anything, let me know! 


-------- Original message -------- 

From: "Rich, Patricia R. (SF) (FBI)" <Patricia.Rich@ic.fbi.gov> 
Date: 10/12/2016 12:01 PM (GMT-05:00) 

To: "Hawkins, F. A. (WF) (FBI)" <Adrian Hawkins@ic.fbi.gov> 
Subject: RE: Follow Up 


Hi Adrian, 

lam happy to follow up directly with Julissa, if that works for you. Please let me know. 
Thanks, 

Patricia 


From: Hawkins, E. A. (WF) (FBI) 

Sent: Wednesday, October 12, 2016 6:23 AM 

To: Rich, Patricia R. (SF) (FBI) <Patricia, Rich @ic.fbi.gov> 
Subject: Fwd: Follow Up 


How should Irespond? Am interested in hearing ideas on how best to approach. 


-------- Original message -------- 

From: "Milligan, Julissa L. (Perkins Coie)" <JMilligan@perkinscoie.com> 
Date: 10/11/2016 4:18 PM (GMT-05:00) 

To: "Hawkins, E. A. (WF) (FBI)" <Adrian Hawkins@ic.fbi.gov> 

Cc: "Sussmann, Michael A. (Perkins Coie)" <MSussmann@perkinscoie.com> 
Subject: RE: Follow Up 


Hi Adrian, 


Following up on your conversation with Michael this afternoon, | wanted to confirm the information we received from the 
DCCC regarding the screenshots. The DCCC confirmed that the first screenshot (beginning with “2015 Events,” “2015 
Holiday Lists” folders) does reflect part of their server. The second screenshot, however, does not appear on their server 
like it appears in the released document. For example, they could not find a folder named “Pelosi Vote Email" or a 
document labeled “1 713 Pelosi DCCC renewal fundraising letter Q1” anywhere on their internal system. They said that it 
was possible that some of the files or folders in that screenshot did exist on their server, but that the format was certainly 
wrong and they were unable to find some of the documents from the screenshot at all. 
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If you have a few minutes, I’d like to follow up by phone to talk about hashing the released and original documents and 
running a comparison--Michael mentioned that you had some ideas about how to do so. | was wondering if you could talk 
me through them, and then we can figure out what makes the most sense for the DNC and DCCC. Let me know what’s 
good for you. 


Thanks, 
Julissa 


Julissa Milligan | Perkins Coie LLP 
ASSOCIATE* 

700 Thirteenth Street, N.W. Suite 600 
Washington, DC 20005-3960 

D. +1,202.654.6368 

F. +1.202.654.9965 

E. JMilligan@perkinscoie.com 


* Application for Bar Admission Pending 


From: Hawkins, E. A. (WF) (FBI) [mailto:Adrian. Hawkins@ic.fbi.gov] 
Sent: Tuesday, October 11, 2016 11:48 AM 

To: Sussmann, Michael A. (WDC); Newell, Sean (NSD) (JMD) 

Cc: Milligan, Julissa L. (WDC); Chan, Elvis M. (SF) (FBI) 

Subject: RE: Follow Up 


I'm checking with SF on their availability. 


-------- Original message -------- 

From: “Sussmann, Michael A. (Perkins Coie)" <MSussmann @perkinscoie.com> 

Date: 10/11/2016 11:17 AM (GMT-05:00) 

To: "Newell, Sean (NSD) (JMD)" <Sean.Newell@usdoj.gov>, "Hawkins, E. A. (WF) (FBI)"” 
<Adrian. Hawkins @ic.fbi.gov> 

Ce: "Milligan, Julissa L. (Perkins Coie)" <JMilligan @perkinscoie.com> 

Subject: Re: Follow Up 


Sean and Adrian, 

Can you two get on a short call today with Julissa and me to discuss the status of your requests? We also 
can just get on the phone with Adrian. I will be OOO tomorrow, so if today doesn’t work, let’s shoot for 
Thursday. 

Thanks, 

Michael 

Michael Sussmann | Perkins Coie LLP 


P: 202.654.6333 
www.perkinscoie.com/msussmann 


From: "Newell, Sean (NSD)" <Sean.Newell@usdoj.gov> 
Date: Tuesday, October 4, 2016 at 10:09 AM 
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To: Michael <msussmann@perkinscoie.com> 
Cc: "Lai, Sarah (NSD)" <Sarah.Lai3@usdoj.gov>, “Shih, Jeffrey (USACAN)" <Jeffrey.Shih@usdoj.gov>, "Chan, Elvis M. (SF) 
(FBI)" <Elvis.Chan@ic.fbi.gov>, "Hawkins, E. A. (WF) (FBI)" <Adrian. Hawkins @ic.fbi.gov>, "Milligan, Julissa L. (WDC)" 


<JMilligan@perkinscoie.com> 
Subject: RE: Follow Up 


Sounds good. Thank you! 


From: Sussmann, Michael A. (Perkins Coie) [mailto: MSussmann@perkinscoie.com] 

Sent: Monday, October 03, 2016 11:13 PM 

To: Newell, Sean (NSD) 

Cc: Lai, Sarah (NSD); Shih, Jeffrey (USACAN); Chan, Elvis M. (SF) (FBI); Hawkins, E. A. (WF) (FBI); Milligan, Julissa L. 
(Perkins Coie) 

Subject: Re: Follow Up 


Sean, 


We certainly can share information with you on a rolling basis. We hope to have some information for you 
later in the week. 


Regards, 
Michael 
Michael Sussmann | Perkins Coie LLP 


P: 202.654.6333 
www.perkinscoie.com/msussmann 


From: "Newell, Sean (NSD)" <Sean. Newell @usdoj.gov> 

Date: Monday, October 3, 2016 at 12:13 PM 

To: Michael <msussmann@perkinscoie.com> 

Cc: "Lai, Sarah (NSD)" <Sarah.Lai3 @usdoj.gov>, "Shih, Jeffrey (USACAN)" <Jeffrey.Shih@usdoj.gov>, "Chan, Elvis M. (SF) 
(FBI)" <Elvis.Chan@ic.fbi.gov>, "Hawkins, E. A. (WF) (FBI)" <Adrian. Hawkins @ic.fbi.gov>, "Milligan, Julissa L. (WDC)" 

<I Milligan@perkinscoie.com> 

Subject: RE: Follow Up 


Michael and Julissa, 

Good morning. | see that there may be another release of documents this week, maybe as early as tomorrow. 
Accordingly, I thought | would take that as an opportunity to check in on the first requests below. Would it be possible 
to do a rolling production? Happy to discuss further, if necessary. 


Thanks! 


Sean 


From: Newell, Sean (NSD) 
Sent: Tuesday, September 27, 2016 6:14 PM 
To: MSussmann@perkinscoie.com 
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Cc: Lai, Sarah (NSD); Shih, Jeffrey (USACAN) (Jeffrey.Shih@usdoj.gov); Chan, Elvis M. (SF) (FBI) (Elvis.Chan@ic.fbi.gov); 


Hawkins, E. A. (WF) (FBI) (Adrian. Hawkins@ic.fbi.gov) 
Subject: Follow Up 


Michael, 


As discussed yesterday, | am writing to request an initial batch of items from your clients. For all victims, DOJ and FBI 
request the following: 


Any released files that are believed to be fake or modified and, if applicable, the original, unmodified file; and 
24-36 released files that were not circulated outside each of victim organizations (e.g., the donor list that was 
mentioned during our meeting) and a preliminary indication as to whether any of these may have been modified. 


For DCCC only, we request access to data and/or employees that could speak to the two screenshots at the bottom of 
this e-mail as having been created from an amalgamation of files or directories on the DCCC network. We believe that 
DCCC and/or Crowdstrike may have looked into these screenshots between on or about September 2 and 6, 2016. 


Finally, as Sarah mentioned during the meeting, some media reporting referred to an ongoing DNC effort to review 
documents to see if any had been “forged.” To close the loop on that, we pulled up the following from a USA Today 
article regarding the September 13, 2016 information release: “In response to that most recent leak, DNC interim chair 
Donna Brazile stated that their ‘legal team is now in the process of reviewing these private documents, and attempting 
to confirm their authenticity, as it is common for Russian hackers to forge documents.’” 


We’ll provide the more comprehensive wish list by the end of the week. 
Thank you. 


Sean Newell 

Deputy Chief — Cyber 

Counterintelligence and Export Control Section 
National Security Division 

U.S. Department of Justice 

(202) 532-4585 


Screenshot 1 
<< OLE Object: Picture (Device Independent Bitmap) >> 


Screenshot 2 
<< OLE Object: Picture (Device Independent Bitmap) >> 


NOTICE: This communication may contain privileged or other confidential information. If you have received it in error, please advise the sender by reply email and 
immediately delete the message and any attachments without copying or disclosing the contents. Thank you 


NOTICE: This communication may contain privileged or other confidential information. If you have received it in error, please advise the sender by reply email and 
immediately delete the message and any attachments without copying or disclosing the contents. Thank you. 
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NOTICE: This communication may contain privileged or other confidential information. If you have received it in error, please advise the sender by reply email and 
immediately delete the message and any attachments without copying or disclosing the contents. Thank you. 
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